Secure gated detection scheme for quantum cryptography 
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Several attacks have been proposed on quantum key distribution systems with gated single-photon 
detectors. The attacks involve triggering the detectors outside the center of the detector gate, 
and/or using bright illumination to exploit classical photodiode mode of the detectors. Hence a 
secure detection scheme requires two features: The detection events must take place in the middle 
of the gate, and the detector must be single-photon sensitive. Here we present a technique called bit- 
mapped gating, which is an elegant way to force the detections in the middle of the detector gate by 
coupling detection time and quantum bit error rate. We also discuss how to guarantee single-photon 
sensitivity by directly measuring detector parameters. Bit-mapped gating also provides a simple way 
to measure the detector blinding parameter in security proofs for quantum key distribution systems 
with detector efficiency mismatch, which up until now has remained a theoretical, unmeasurable 
quantity. Thus if single-photon sensitivity can be guaranteed within the gates, a detection scheme 
with bit-mapped gating satisfies the assumptions of the current security proofs. 

PACS numbers: 03.67.Dd 
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I. INTRODUCTION 

Quantum mechanics allows two parties, Alice and Bob, 
to grow a random, secret bit string at a distance [H-ll]. 
In theory, the quantum key distribution (QKD) is secure, 
even if an eavesdropper Eve can do anything allowed by 
the currently known laws of nature [SHOj. 

In practical QKD systems there will always be imper- 
fections. The security of QKD systems with a large vari- 
ety of imperfections has been proved [1, ITol - [l5| . Device- 
independent QKD tries to minimize the number of as- 
sumptions on the system, but unfortunately the few as- 
sumptions 0, [l^, in the security proofs seem to be too 
strict to allow useful implementations with current 
technology [Toj . 

Several security loopholes caused by imperfections 
have been identified, and attacks have been proposed and 
in some cases implement ed fisl . [20l - l32| . With notable ex- 
ceptions dS HH, m, m Hjmost of the loopholes are 
caused by an insufficient model of the detectors. 

While several detection schemes exist, most implemen- 
tations use avalanche photodiodes (APDs) gated in the 
time-domain to avoid high rate of dark counts. Gated 
means that the APD is single-photon sensitive only when 
a photon is expected to arrive, in a time window called 
the detector gate. Attacks on these detection schemes are 
based on exploiting the classical photodiode mode of the 
APD, or the detector response at the beginning/end of 
the detector gate. 

In the attacks based on the classical photodiode mode 
of the APD, the detectors are triggered by bright pulses 
(26l [lo'l . If necessary, the APDs can be kept in the clas- 
sical photodiode mode, in a so-called blind state, using 
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additional bright background illumination [26|, |27|, |29|, |32|, 
Issj . When the detectors are blind, they are not single- 
photon sensitive any more, but only respond to bright 
optical trigger pulses. In most gated systems, blinding is 
not necessary because the APDs are in the classical pho- 
todiode mode outside the gates. Therefore, in the after- 
gate attack |34| | , the trigger pulses are simply placed after 
the gate. 

Several attacks are based on detector efficiency mis- 
match (DEM) [22]. If Bob's apparatus has DEM, Eve 
can control the efficiencies of Bob's detectors individu- 
ally, by choosing a parameter t in some external domain. 
Examples of such domains can be the timing, polariza- 
tion, or frequency of the photons an example, 
consider DEM in the time-domain. Usually Bob's appa- 
ratus contains two single-photon detectors to detect the 
incoming photons, one for each bit value. Due to differ- 
ent optical path lengths, inaccuracies in the electronics, 
and finite precision in detector manufacturing, the detec- 
tion windows and hence the efficiency curves of the two 
detectors a and b are slightly shifted, as seen in Fig.[lja). 
Several attacks exploit DEM [l^ [2^, in various proto- 
cols [35| . some of which are implementable with current 
technology. The time-shift attack [2^ has been used to 
gain an information-theoretical advantage for Eve when 
applied to a commercially available QKD system [sOI . In 
the experiment. Eve captured partial information about 
the key in 4% of her attempts, such that she could im- 
prove her search over possible keys. 

After each loophole has been identified, effort has been 
made to restore security of the detection schemes. DEM 
is now included in the receiver model of several security 
proofs (IZ , 13, 15] as an efficiency mismatch or blinding 
parameter rj, defined differently according to the gener- 
ality of the proof. For arbitrary systems that can be 
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described with linear optics [l3j. 

^ ^ mint {>?aft),>?bft)} 
maxt {77a (i), ?7b(0} ' 

where rjait) and ?76(<) are the detection efficiencies of the 
two detectors. Here t labels the different optical modes; 
in the special case without mode coupling it labels the dif- 
ferent temporal modes. An example is given in Fig. [IJa). 
In the most general case 77 is given by the lowest prob- 
ability that a non-vacuum state incident to Bob is de- 
tected (isj . For either definition of 77, there is an infinite 
number of modes involved (all superpositions of temporal 
modes [l^l) which makes the blinding parameter difficult 
to measure or bound in practice. For a given value of rj, 
the secret key rate is given by ^] 

R>~h{E)+^{l^h{E)), (2) 

where E is the quantum bit error rate (QBER) measured 
by Alice and Bob, and h{-) is the binary Shannon entropy 
function. Here we have assumed symmetry between the 
bases in the protocol; in addition, we have ignored any 
basis leakage from Alice and back-refiection from Bob 
(the most general expression is given in the original ref- 
erence fisj ) . Unfortunately, in practical systems the rate 
([2]) will usually be zero, since 77 — )■ due to the edges 
of the detector gates. For the commercial QKD system 
subject to the time-shift attack, 77 < 0.01 (estimated from 
the curves in [13, Fig. 3] using Eq. ([T|)). 

As noted in [13], one way of obtaining a better rj would 
be to discard pulses near the edge of the detector gate. 
Then rj could be calculated from ^ including only the 
modes t which are accepted as valid detections. How- 
ever, this is highly non-trivial. The avalanche in an APD 
is a random process, and the jitter in the photon-timing 
resolution is of the same order of magnitude as the du- 
ration of the detector gate. A good photon-timing re- 
solving detector still has 27 ps jitter [3g. Furthermore, 
the unavoidable difference in the acceptance windows for 
the different detectors will also contribute to DEM (one 
detector accepts clicks while the other discards them). 

A frequently mentioned countermeasure for systems 
with DEM is called four-state Bob [H, [H, [13, [ll . Then 
Bob uses a random detector-bit mapping, randomly as- 
signing the bit values and 1 to the detectors a, b 
for each gate. In a phase-encoded QKD system, this 
can be implemented by Bob choosing from four differ- 
ent phase settings {0,7r/2,7r, 37r/2} instead of only two 
{0,7r/2}. Then Eve does not know which detector char- 
acteristics correspond to which bit value. However, as 
mentioned previously jisl . [22I . [23j this patch opens a dif- 
ferent security loophole. Eve may use a Trojan-horse 
attack [23, [U, [13, [4^ to read Bob's phase modulator 
settings, thus additional hardware modifications are re- 
quired. Note also that the four-state Bob patch does not 
secure against the after-gate attack nor any of the 
detector control attacks [23, [13| • 
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FIG. 1. (Color online) Bit-mapped gating, (a) Detector gates 
with DEM. ria{t) (blue, dashed) and r]i,{t) (red, solid) are the 
efficiencies of the two detectors a and b. (b),(c) Possible op- 
tical bit-mapping (purple) when the software bit-mapping is 
set to a 0, 6 1 (Fig. (b)) and a ^ 1, b ^ (Fig. (c)). In 
a phase-encoded system the two levels would correspond to 
and TT phase shift in one basis, and 7r/2 and 3n/2 phase shift 
in the opposite basis. Note that the software bit-mapping 
and the optical bit-mapping coincide in the bit-mapped gate, 
which is well within the detector gates, (d) QBER^i^(t) 
(green) as obtained from ^ with the bit-mapped gate shown 
in (b) and (c). 



Here we present a novel way of securing Bob's re- 
ceiver called bit-mapped gating (Section |n|. It secures 
the system against all kinds of pulses outside the central 
part of the detector gate in the Bennett-Brassard 1984 
(BB84) and related protocols [l[,[ill-[4|. The technique 
is compatible with the existing security proofs [T2l.[l3l[l5j 
and makes it simple to find 7/. In general it represents 
a useful concept, where parameters from characteristics 
of the QKD system are coupled to the parameters esti- 
mated by the protocol. In this case 77 becomes coupled 
to the QBER. Subsequently we analyze the security of 
bit-mapped gating (Section HIT)) , discuss how to charac- 
terize detectors, and how to implement a guarantee of 
single-photon sensitivity (Section lIVp . Finally we con- 
clude (Section El). 



3 



II. BIT-MAPPED GATING 



III. SECURITY ANALYSIS 



Let us start with two definitions. The software bit- 
mapping determines how the signals from detectors a 
and b are mapped into the logical bits 0, 1. Similarly the 
optical bit-mapping which can be implemented by gener- 
alizing the basis selector, maps quantum states with bit 
values 0, 1 (for instance |0), |1) in the Z-basis) to the 
detectors a, b. Note that if the software bit-mapping and 
the optical bit-mapping do not coincide, a bit value 
sent by Alice will be detected as bit value 1 by Bob. 

Bit-mapped gating works as follows: 

• Somewhere in between the detector gates. Bob ran- 
domly selects the software bit-mapping, assigning 
detectors a, b to bit values 0, 1. 



• Likewise, the basis is selected randomly between 
the X and Z basis, along with a random optical bit- 
mapping. Since this happens between the detector 
gates, jitter is not critical. 

• Inside the detector gate, the optical bit-mapping is 
matched to the software bit-mapping. The period 
with matching optical and software bit-mapping is 
the bit-mapped gate. 

Note that the optical bit-mapping can be equal on both 
sides of the bit-mapped gate to minimize the need for 
random numbers. Fig. [T] shows a typical time diagram. 

As an example, consider a phase-encoded implementa- 
tion of the BB84 protocol, where the basis selector at Bob 
is usually a phase modulator. phase shift corresponds 
to Z basis and 7r/2 phase shift corresponds to the X basis. 
The optical bit-mapping can be selected by adding either 
or TT to the phase shift. Hence in this implementation 
the bit-mapped gating patch could be implemented as 
follows: Bob randomly selects the software bit-mapping 
somewhere between the gates. Furthermore, Bob selects 
a random basis, i.e. or 7r/2 phase shift between the 
gates, and adds either or tt to the phase shift to apply 
the random optical bit-mapping. During the gate, the 
software and the optical bit-mapping coincide. 

All states received and detected outside the bit- 
mapping gate cause random detection results (due to the 
random optical and software bit-mapping), and thus in- 
troduce a QBER of 50%. The measured QBER could be 
used to estimate the fraction of detections which must 
have happened in the center of the gate (in Fig. [T] close 
to zero QBER would mean that most detection events 
must have passed the basis selector, and thus hit the 
detector, in the middle of the gate). This can be used 
to limit the DEM, because considering only the modes 
in the center of the detector gate gives less DEM than 
considering all modes. 



The goal of this section is to derive an expression for 
the minimum QBER introduced by any state received by 
Bob, during the transition to and from the bit-mapped 
gate. Ideally, the minimum QBER is inside the bit- 
mapped gate, and 1/2 outside the bit-mapped gate. 

The input of Bob's detection system consists of many 
optical modes t, for instance corresponding to different 
arrival times at Bob's system. Each mode t may con- 
tain a mixture of different number states. Note that Bob 
could have measured the photon number in each mode 
without disturbing the later measurement; thus it suf- 
fices to address specific number states. We use the usual 
assumption that each photon in a n-photon state is de- 
tected individually. Under these assumptions, we first 
calculate the minimum QBER caused by a single photon 
arriving in a single mode at Bob. Then, in appendix |X] 
we show that multiple photons in this mode, or photons 
in other modes can only increase the minimum QBER. 

Consider a single photon arriving at Bob in a given 
mode t. Since the BB84 protocol is symmetric with re- 
spect to the bit values and the bases, we may assume 
without loss of generality that Alice sent ZO and that 
Bob measures in the Z basis. Outside the bit-mapped 
gate. Bob performs four different measurements depend- 
ing on the software and optical bit-mapping. For each 
measurement. Bob will obtain one out of three measure- 
ment outcomes, bit 0, bit 1 or vacuum denoted by sub- 
script V. 

Let r]a, rib be the efficiencies of the two detectors, 16*) = 
cos6'|0)-f sin 6*11) and \e^) = sin6l|0) -cose*!!). During a 
bit-mapped gate, 9 is varied from to 7r/2. For each value 
of 6, Bob performs one out of the four measurements 



Mo = r;„|0)(0|,Afi=77fc|l)(l|, 
-/-Afo-A/i, 

M^ = 77b|0)(0|,M{ = r;,|l)(l|, 
= 1- M'^ - M{', 
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(3a) 



(3b) 



(3c) 



(3d) 



If Bob uses the four measurements with equal proba- 
bilities, the statistics will be given by using the measure- 
ment operators 

E^^\ {Mo + + M'^ + Mi;') 

= \{r]a + Tlbm+ cos" em {Q\+&m^e\\){l\ ^^^^ 
+ sin6lcos6l(|0)(l| + |1)(0|)), 
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Ei^- {Ml + M[ + M[' + M[") 



(l + cos^ 9)\l){l\ 



(4b) 



sm 



;cos0(|O)(l| + ll)(O|)), 



(4c) 



Note that Ey oc /, so the detection probabihty is inde- 
pendent of the photon-state p: 



Pdct = 1 - Tr[pEy 



Va + Vb 



(5) 



The eigenvalues of operators Eq and Ei are given by 
Pdet(licos0)/2. Thus the minimum and maximum prob- 
abihty of detecting bit values and 1 for any single pho- 
ton sent by Eve is given by 



PO,min =Pl,min = ~ COSe*), 



Pi: 



Pdct 



(1 -I- COS 6*). 



(6) 
(7) 



Since Alice sent ZO, the minimum QBER introduced by 
a single photon is given by 



Pi, 



1 



Pdct 



(1 



(8) 



As expected, for 6 = n/2 QBER,jji„ = 1/2. For multi- 
photons, a random bit value is assigned to double clicks 
[lot [l^ . Appendix shows that sending multiple pho- 
tons can only increase the QBER caused by detection 
events. Hence Eq. ([8|) gives the minimum QBER for any 
photonic state sent by Eve. 

The security proofs in Refs. [H, [13, EBl involve Bob 
predicting the results of Alice's virtual X-basis measure- 
ment. Since the prediction is not carried out in practice, 
Bob can perform any operation permitted by quantum 
mechanics. In the proofs Bob's prediction consists of 
a filter followed by an "X-basis" measurement. When 
nothing is known about the distribution of the detec- 
tion events within the gate, the worst case assumption is 
that all the detection events occur with maximum DEM. 
Therefore, the best filter we can construct can only guar- 
antee that a fraction r] of the inputs can successfully pass 
the filter. 

With our patch, we may use the QBER to determine 
a lower bound for the number of detection events which 
must have happened in the central part of the detector 
gate. Assuming that t labels temporal modes, consider 
the number of detection events which occurred in the 
range where QBER^j^ < E' (see Fig. [2]). Here, E' is a 
threshold selected by Bob. Let rj' be the blinding param- 
eter for the modes for the range where QBERj^j^ < E' . 
It can be calculated from Eq. ([T}, but where t only runs 




FIG. 2. (Color online) Curves (a) and (d) from Fig. [T] The 
dashed line shows how a threshold E' can be used to limit the 
range of modes t used to calculate or bound i]' . 



over this range. If the measured QBER is equal to E, a 
fraction 



/ 



E' - E 



(9) 



must have been detected in the modes where QBERj-^jj^ < 
E'. Note that increasing E' increases /, and may de- 
crease 77' (see Fig.m. As will become apparent below, E' 
should be selected to maximize frj'. 

For decoy protocols ^41,-,43J , E should be replaced with 
the QBER estimated for single-photon states. This im- 
proves the estimate of the fraction /, especially for large 
distances where the dark counts become a major part of 
the total QBER. 

In the worst fraction / experienced a reduced 

DEM 77'. Therefore, the filters in the security proofs can 
be replaced as follows: the new filter discards pulses in 
the modes for which QBERj^^jj^ > E' . For the modes in- 
side the bit-mapped gate, where QBERj^^jj^ < E' , the new 
filter reverts the quantum operation from the receiver in 
the opposite basis in the same way that the old filter re- 
verted it for all modes, but now having success rate 77'. 
Since we can guarantee that a fraction / of the photons 
are in the bit-mapped gate, at least 77'/ pulses will suc- 
cessfully pass the new filter. Therefore the parameter 77 
in all the proofs [H, [13, Ell can be replaced with 77'/, 
and the rate ^ becomes 



R>^h{E) + frj'[l-h{E)], 



(10) 



when one assumes symmetry between the bases, and no 
source errors. Without symmetry between the bases, all 
parameters become basis-dependent, and the rate is the 
sum of the rates in each basis. 

Let us see how bit-mapped gating could improve the 
secure key rate for the commercial QKD system in [soj . 
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For this system rj < 0.01. In the same experiment, the 
QBER is measured to be 5.68%. Assuming E' — 0.45 and 
7]' = 0.9, frj' becomes 0.79; thus a substantial improve- 
ment. In fact, the rate obtained from Eq. © without 
the patch is 0, while the rate obtained from Eq. (|10p is 
0.227, so clearly the patch can be used to re-secure an 
insecure implementation. 



IV. DETECTOR DESIGN AND 
CHARACTERIZATION 

When designing Bob's system, one should ensure that 
the bit-mapped gate is well within the detector gate, 
i.e. that the detector efficiencies are approximately equal 
within the bit-mapped gate. Then, it should be possible 
to measure or bound the detector efficiencies and the ba- 
sis selector response 9{t) in the temporal domain. In a 
phase-encoded system this would correspond to measur- 
ing the detector efficiencies and the phase modulation as 
a function of time [i^l , over the range of wavelengths and 
polarizations accepted by Bob. With this data, the mini- 
mum QBER as a function of time can be calculated from 
([5]), and a diagram similar to Fig. [2] can be obtained. 
After selecting an appropriate limit £", rj' can be calcu- 
lated by ([1]) but where t runs only over the modes where 
QBER„ji„ < E', and not over all available modes. 

In general there might be coupling between the differ- 
ent temporal modes due to misalignments and multiple 
reflections [l^ . [l3| . The bit-mapped gate ensures that 
the pulse passed the basis selector inside the temporal 
detector gate, but does not guarantee the actual detec- 
tion time. For example, a pulse could pass in the center 
of the bit-mapped gate, but afterwards take a multiple 
reflection path such that it hits the detector outside the 
detector gate. This can be handled by characterizing the 
worst case mode coupling as described previously [l3| . 
Let S be the worst case (power) coupling of modes inside 
the bit-mapped gate to outside the gate. This will typi- 
cally be the worst case multiple-reflection path after the 
basis selector, and should be boundable from component 
characteristics. Then, the parameter 6 can be interpreted 
as 

^ #pulses that hits the detector outside the gate 

= . 

#pulses sent into the gate 

(11) 

In the worst case, 6 of the / detection events might have 
happened outside the central part of the detector gate; 
thus one must let / /(I — 6). 

Finally one must guarantee that the detectors are not 
blind within the gate [29], and fulfill the assumptions 
in Section IIIII during the transition of the optical bit- 
mapping. Note that the transition ends when there is no 
longer any correlation between the software bit-mapping 
and the optical bit-mapping. If a significant correlation 
exists also after the detector gate, it could be exploited 
in the after-gate attack [341] . 
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FIG. 3. (Color online) A calibrated light source inside Bob. 
The figure shows the Bob module in a plug-and-play system 
BiEEtISI with two possible implementations of the calibrated 
light source: either a separate attenuated laser diode (LD) at 
a suitable place, or in the case of send-return systems where 
Bob already contains a laser diode a weakly reflective element 
(R) to reflect some light back into the APDs. A short delay 
line (DL, delay > gate period/2) at Bob's input guarantees 
that Eve cannot interfere with the detector operation based on 
whether the source is activated or not. PBS: polarizing beam 
splitter; Att.: optical attenuator; PM: phase modulator; C: 
50/50% fiber-optic coupler. 



Although it is tempting to place an optical watchdog 
detector at the entrance of Bob, the absence of bright il- 
lumination does not necessarily mean that the detectors 
are single-photon sensitive. For instance, due to the ther- 
mal inertia of the APD, it can remain blind for a long 
time after the bright illumination is turned off 33] . 

A cheap way to guarantee single-photon sensitivity is 
to monitor all detector parameters [l^l, such as APD 
bias voltage, current and temperature. It seems difficult 
to monitor the temperature of the APD chip [s^, but 
monitoring the bias voltage and current should make it 
possible to predict the heat generated by the APD, and 
thus prevent thermal blinding (33j . 

The ultimate way of guaranteeing single-photon sen- 
sitivity is to measure it directly. This can be done by 
placing a calibrated light source inside Bob that emits 
faint pulses at random times [12] (see Fig. [S]). Then the 
absence of detection events caused by this source would 
indicate that the detector is blind. Further, a calibrated 
light source inside Bob could be useful in more ways, 
for instance to characterize and calibrate detector per- 
formance in deployed systems. 

The patch could cause a minor reduction in QKD 
performance compared to running an (insecure) system 
without the patch. In particular, the detector gates 
might have to be longer to contain the basis-selector gate. 
This would increase the dark count rate, and thus limit 
the maximum transmission distance. A calibrated light 
source inside Bob would also cause a minor reduction 
in the performance since the gates used for testing the 
detector sensitivity likely cannot be used to extract the 
secret key. However, both these effects are minor, and 
are easily justified by the restoration of security. 
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V. DISCUSSION AND CONCLUSION 

In this work, we have presented a technique called "bit- 
mapped gating" to secure gated single-photon detectors 
in QKD systems. It is based on a general concept where 
hardware imperfections are coupled to the parameters 
estimated by the protocol. Bit-mapped gating causes all 
detection events outside the central part of the detector 
gate to cause high QBER. 

Bit-mapped gating is compatible with the current secu- 
rity proofs for QKD systems with detector efficiency mis- 
match IT3I [lH . In particular it provides a simple way 
of measuring the detector blinding parameter. A secure 
gated detection scheme is obtained if bit-mapped gat- 
ing is combined with detectors guaranteed to be single- 
photon sensitive. 
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Appendix A: Minimum QBER for multiphotons 

Here we prove that the minimum QBER can only in- 
crease when the number of photons sent to Bob is in- 
creased. As noted previously we use the usual assump- 
tion that each photon in a n-photon state is detected 
individually. This means that each photon hits a sepa- 
rate set of detectors, and then the detection results are 
merged to give the detection results of threshold detec- 
tors. 

Let us first consider the case where Bob receives a large 
number of two-photon states. Let the two photons within 
the states be labeled 1 and 2. Individually, each of the 
two photons would have caused the minimum QBER Qi 
and Q2 (as found from Eq. ([5])). Again we assume that 



Alice sends the bit value 0, without loss of generality. For 
two-photon states there will be three cases of detected 
events: either only photon 1 is detected, only photon 2 
is detected, or both photons are detected (in our model, 
this latter possibility corresponds to the case where both 
sets of detectors register a click). Let there be ni events 
where only photon 1 was detected, n2 events where only 
photon 2 was detected, and c events where both photons 
were detected. For photon i, out of the rii — n^.o + 
events, n^^o and n^^i were detected as the bit value and 
1, respectively. Likewise, out of the c = q q + Cj,i events 
where both photons are detected, Ci^ and Ci^i were de- 
tected as the bit value and 1 for photon i (remember 
that in the model each photon hits a separate set of de- 
tectors). 

When only one of the photons is detected, the situa- 
tion is identical to the single-photon case treated in Sec- 
tion |TTT1 Hence states such that Qi = ni^i/n.i give the 
lowest possible QBER. For the events where both pho- 
tons are detected, the detections can have any correla- 
tion, but for each photon Ci_i > cQi since Qi represents 
the lowest fraction of the bit value 1 possible, regard- 
less of the correlation with any other photon. The total 
QBER Q can be found from merging the detections from 
the two sets of detectors. Double clicks are assigned a 
random bit value [i3|j therefore half of the double 
clicks get the bit value 1. This gives the total QBER 

^ _ ni.i + + I (ci,i + C2,i) 

ni + 712 + c 

^ Qi {ni + f ) + Q2 (^2 + f ) (Al) 
~ ni +n2 + c 

> min (Qi, (92) • 

By repeating the argument above, but replacing the 
detection of photon 1 with the detection of N photons, 
it is easy to see that Q > min (QjVj Qat+i)- Hence by 
induction, any detection event caused by more than one 
photon can only cause a higher QBER than the single- 
photon case. 
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